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Executive Summary 


Understanding the current trends and challenges 
facing law enforcement, military, and intelligence 
agencies worldwide is critical to staying ahead in 
the rapidly evolving world of Digital Intelligence. 
Seeing the context that’s driving these trends 
and challenges is equally important. This is why 
Cellebrite is publishing its third annual Digital 
Intelligence Benchmark Report. 


This year’s report is particularly important given 
the unusual year we've just been through. Working 
remotely and not being able to access labs or 
collaborate face-to-face with our colleagues 

made it particularly challenging for forensic lab 
examiners, investigators, and agency managers 
everywhere. This is why your answers to this 
year’s Survey are more relevant and insightful 
than ever. 


This year had some unique, and unexpected, 
impacts on crime as well. At a macro-global level, 
nearly half the world’s population - 3.9 billion 
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people - experienced some form of lockdown 

in 2020. Interestingly, the result was a major 
decrease In crime, according to a United Nations 
Report [71]. However, despite this temporary dip 
in certain crimes, the report reveals the amount 
of overtime worked by examiners in 2020 declined 
by just three percent compared to 2019 levels 
and there was no material improvement in the 
average number of hours [42] that investigators 
Spent reviewing digital evidence. Investigators 
reported a 5-7 day average turnaround time for 
investigators to receive data and an initial report 
from examiners in the lab. 


For our community, having access to the 
preponderance of data that’s now at hand should 
be a goldmine for investigators working to move 
cases forward quickly. However, our survey 
results indicate that resolving a case has never 
been harder. There's so much digital data to 
make sense of that high-profile cases take days, 
and the rest of the backlog can take months to 
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process. In many agencies, this evidence gets 
stored manually, or on removable media, making 
it impossible for teams to seamlessly and securely 
share information, validate leads, or collaborate to 
solve cases more easily. It has been reported that 
investigators can hardly keep up with caseloads 
today, let alone prepare for tomorrow. 


Management has been equally challenged. 

The report revealed that managers within law 
enforcement, military, and intelligence agencies 
recognize that major inefficiencies in the system 
remain a problem. One third of agency managers 
surveyed reported that they were dissatisfied with 
their agency's strategy for collecting, preserving, 
managing, and safeguarding digital evidence 
from devices and the Cloud. And 35% said they 
were dissatisfied with their agency's strategy for 
processing and analyzing digital evidence. 


Key Findings 


The report surfaced five major development areas 
that are inhibiting law enforcement agencies 
from mastering digital evidence as part of their 
investigative workflow: 


Staffing Shortages: 

Despite recruitment-and-retention challenges 
that law enforcement agencies are grappling 
with, the Digital Intelligence Benchmark Report 
revealed just seven percent of agencies plan to 
hire additional examiners to help process digital 
evidence. This resource crunch is placing an 
additional burden on agencies that are at or above 
their existing investigative capacity - emphasizing 
the need for new practices around targeted 
forensics. 
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Skills Shortages: 

Most law enforcement agencies are still 

lacking sufficient IT expertise to implement 

and operationalize new digital technologies to 
speed up the process of collecting, analyzing, 
storing, managing, and sharing digital evidence. 
Investigators also lack the training to effectively 
use such tools. In fact, our survey found that half 
of agency management believes their staff is not 
properly trained for digital evidence. 


Tools and Technologies: 

Given that 96% of investigators and 47% of 
examiners feel they miss key evidence, the need 
for technology is striking. They agreed that with so 
much time and energy spent on reviewing digital 
data, more effective tools are needed to accelerate 
time to evidence. 


Intra- and Inter-agency Silos: 

Digital evidence from multiple devices often needs 
to be compared, contrasted, and investigated 
alongside other data sources such as the Cloud, 
CDRs, and data from RMS and internal police 
databases. However, because of silos between 
different departments and IT systems, it takes 


longer than it should to surface insights and leads. 


Lacking Strategy: 

59% of agency managers said they have a poor or 
no digital transformation strategy and are likely to 
prioritize digital transformation. 
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Methodology : 
1% 
APAC 
Cellebrite’s third annual Digital oo” 
Intelligence Benchmark Report 
analyzed the results from more 
than 2, respondents trom 
han 2,000 respond f 5 1 % 
117 countries (Figure 01). FIG. 01 a thá 
Respondents included a wide Respondents 
spectrum of law enforcement By Region 
personnel including forensic lab 
examiners, investigators, and 
agency managers. 25% > 
| EMEA 
8 : 


FIG. 02 
How would you categorize your current place of employment? 


Of the 2,000 respondents from 
Local Law 


Enforcement the survey, which represent large, 


medium, and small agencies 
globally, 36% were from local/ 


State/Provincial 
Law Enforcement 


regional law enforcement 
Federal/National 


Law Enforcement agencies, 22% were from state 


law enforcement agencies, 
Prosecutor's Office 


/ District Attorney and 27% were from federal 

law enforcement and military/ 
Other Government i ' i . 
Agency intelligence agencies [Figure 02]. 
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2021 Benchmark 
Report Findings 


Everything we do leaves a 
digital footprint 


As our society becomes more reliant on technology, 
everything we do leaves a digital footprint—key data 
that can provide valuable evidence for investigators. 


Not surprisingly, as the list of digital sources 
grows—phones, computers, and tablets, CCTV, 
wearables, cryptocurrency, etc.—so does the 
amount of digital evidence law enforcement 
investigation teams are surfacing. 


The 2021 Digital Intelligence Benchmark Report 
revealed that 96% of examiners surveyed said that 
smartphones appeared frequently or very frequently 
in their investigations in the past year, followed by 
Windows computers (52%), feature phones (45%), 
and tablets (39%). Emerging technologies, a growing 
resource for digital evidence that includes wearables 
and cryptocurrencies, also provided evidence in 8% 
of investigations in 2020. 
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63% of cases no | ABER 

2 GR In the past year, how frequently did the following evidence sources 
include digital appear in your investigations? 

evidence as 

part ofthe 


investigation 96% 52% 45% 


For investigators, this should 

be a gold mine. But in reality, 

resolving a case has never 

been harder. There's so < 7; 
much digital data to gather, — BE 


process, and make sense of, Smartphones Windows Computers Feature Phones 


that investigative teams are 


struggling to keep pace. N 
a 4 
| 3% 


39% 34% 2 
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Tablets CCTV MacOS Computers 
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11% 8% 8% 
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Resolving a case has never been harder 


In fact, to handle the proliferation of devices, examiners increasingly prioritize and only examine time- 
sensitive data or only devices from certain cases. This trend has been ongoing for the past two years, 
while working overtime, hiring new examiners, or expanding the lab has steadily decreased as agencies 


face budget pressures. 


FIG. 04 
If you are experiencing backlogs, how do you handle them? E20 2020 ë E2021 


We prioritize and only Our examiners work We have expanded or will We have hired or will hire 
| examine time-sensitive overtime to complete expand our lab more examiners 
| data, or only devices from exams 


certain kinds of cases 


Examiners prioritize and only examine time-sensitive data, or 
devices from high-priority cases 


Challenges such as locked devices, encrypted apps, and the sheer amount of data slow down the 
investigation. The report found that 6 out of 10 devices that reach the lab are locked, statistically 
unchanged from the prior year. Without proper tools to be able to access the data, these devices, which 
can contain crucial evidence, are often excluded from investigations solely because the data could not be 


accessed. 
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6 out of 10 devices 


er 58% 57% 


FIG. 05 
In the past three months, what 
percentage of devices that 


reached your lab were locked? 
Global Average: 2020 Global Average: 2021 


Furthermore, the report found that encrypted apps and the amount of data that needs to be extracted add 
additional challenges that slow the investigative process. 


FIG. 06 
Aside from mobile devices being locked, what are the biggest challenges 
you face when performing digital extractions? (Select all that apply) 


56% Inability to extract data from encrypted apps 
0 


54% The amount of data that needs to be extracted 


47% Not getting enough data from the device 


36% The volume of phones 


0 Devices that have been damaged 
36% 


0 Inability to decode artifacts 
32% 


0 Extractions crashing in the middle 
20% 


1 5% Creating an extraction report with the relevant data 


1 4% Efficiently sharing the data with colleagues outside the lab 


1 0% Inability to correlate extracted data from multiple phones 


9% Retrieve data from previous extractions for cross analysis 
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It takes 5-7 days to process a device (on average) 


Even for high-profile cases, which are typically prioritized, it can still take several days or even weeks to 


provide the data and report to investigators so they can incorporate the findings into their investigations. 


FIG. 07 
How long does it typically take to receive the analysis report after 
a digital device is submitted for extraction for high-priority cases? 


35% 


17% 
AVERAGE 


- - 13% 

1 | % 1 2% 
1% 

5% 


1-2 Days 3-4 Days 5-7 Days 1-2 Weeks 3-4 Weeks 4-6 Weeks More than 6 
Weeks 
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47% of examiners feel 
data is still missing 


And nearly half of the examiners who 
responded still feel like significant 


amounts of data is missing from O 
device examinations, which could have 
implications in solving cases efficiently. O 


FIG. 08 

| feel that there are significant 
amounts of data that | am missing from 
examinations of digital devices, which 
could have serious implications in 


solving cases efficiently and effectively. tais fis 
obal Average: 


FIG. 09 
In the past three months, of all the mobile extractions you performed, what percentage were 
physical/full-file-system extractions? YoY Comparison 


D uas) D 


| 2019 Average 2020 Average 2021 Average 


Examiners noted that of all the extractions performed in the past three months, only 45% were physical / 
full file system extractions. With the clock always ticking against them, examiners have little time to get 
deep into the data, including deleted data. 
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97% of investigators feel key evidence is missing °—- — ~~~ 


Some 97% of investigators reported feeling that key evidence is missing and/or lost when reviewing 
digital data. And over half believe this happens most of the time. Contrary to what one might think, 
once investigators have the data and the report from the lab, the investigation process does not get 
easier. In fact, it can get even more complicated. In the report, 60% of investigators agree that review 


of digital data is still too complex. 


3% Ah 


Never E Always 


2 


14% 


Most of the Time 


FIG. 10 
How often do you feel that key 
evidence is missing and/or lost when 
reviewing digital data? 


About Half 
the Time 


Sometimes 
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O 
60% of investigators | 73% of investigators 
believe data review is | believe data review 
too complex | takes too long 
FIG. 11 | FIG. 12 
To what extent do you agree/disagree that i To what extent do you agree/disagree that 
review of digital data is too complex? | review of digital data takes too much time? 


50% 73% 


Agree i Agree 


For investigators, reviewing digital data takes too much time and they can spend as much as 48 hours per 
week on average reviewing photos, videos, text messages, CCTV footage, and creating reports. In a further 
challenge to investigators, digital evidence often gets stored on DVDs, flash drives, and other removable media, 
making it even more difficult for teams to share clues securely, validate leads, and solve cases together. 


FIG. 13 
In the past week, how much time did you spend on: reviewing photos, recorded 
videos, CCTV, text messages and conversations, and creating reports? 


Photos Recorded Videos Text Messages and CCTV and Creating 
from Devices from Devices Conversations Surveilance Videos Reports 
bá bá bá bá bá 
11 hours 9 hours 10 hours 7 hours 11 hours 


48 hours 


Total hours spent per week 
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A third are dissatisfied with sharing and collaboration procedures 


Organizations reported effective and efficient collaboration as a major challenge. A staggering 1 in 3 


investigators and agency managers reported being unsatisfied with the process. 


FIG. 14 
How satisfied/dissatisfied are you with your 
agency's culture of collaboration between 
examiners, investigators, and prosecutors 
as they work on digital investigations? 
(Agency Management] 


3670 


Dissatisfied 


96% of investigators miss 
more effective tools to 
accelerate time-to-evidence 


With all the time and energy spent on reviewing 
digital data, nearly all investigators realize that 
more effective tools are needed to accelerate 
time-to-evidence. It’s extremely challenging 

to prepare for tomorrow if it is becoming more 
and more difficult keeping up today. 
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FIG. 15 
To what extent do you agree/disagree 
that your agency collaborates well in 
investigating digital evidence? 
(Investigators) 


3370 


Disagree 


FIG. 16 
To what extent do you agree/disagree that 
investigations could benefit from more effective 
tools to accelerate time-to-evidence? 


96% 


Agree 
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A third of agency managers are dissatisfied with their strategy 
across the investigative workflow 


Agency managers were overwhelmingly dissatisfied with their organization's strategy for dealing with 
digital evidence at all levels. This points to the urgent need to revamp and/or plan a digital transformation 
strategy that will help agencies operate more efficiently and close more cases faster. 


| ty 


O we How satisfied/dissatisfied are you with your 
0 agency's strategy for collecting and preserving 


digital evidence from devices? 


Dissatisfied 


FIG. 18 


How satisfied/dissatisfied are you with your i A O 
agency's strategy for processing and analyzing 0 


digitaLevidence from devices? 


Dissatisfied 


FIG, 19 


0 ye How satisfied/dissatisfied are you with your 
0 agency's strategy for managing and safeguarding 


digital evidence from devices? 


Dissatisfied 
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55% of agency managers 
have a mediocre or no 
digital transformation 
strategy at all 


Some 46% of agency managers said 
they have a mediocre or poor digital 
transformation strategy, and 9% have no 
strategy at all! 


In comparison to the prior year, 
agencies realize that the status quo 

is not sustainable. The world is going 
digital, and the COVID-19 pandemic only 
accelerated the urgency to transform 
digitally. Agencies that do not reinvent 
themselves in the digital age risk being 
left behind. 


M Mediocre or Poor Digital Transformation Strategy 


® No Digital Transformation Strategy 


2021 Digital Intelligence Benchmark Report 


FIG. 20 
How advanced is your agency’s digital 
transformation strategy? 


9% 


2020 2021 
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95% of agency managers agree 

M An expert partner is key to successful transformations 

M Technology can increase efficiency and time-to-justice 

What agencies need is a trusted partner that offers unparalleled technology that can help them operate 
more efficiently and close more cases faster. In fact, 95% of agency management believe that a trusted 


partner vendor is key to a successful digital transformation. And nearly all agency management 
respondents believe technology can help them close more cases faster and operate more efficiently. 


FIG. 21 FIG. 22 
Trusted relationships with expert | believe that technology can help my 
partners/vendors are key to successful agency operate more efficiently and 
digital transformation. close more cases faster. 


95% 96% | 


Agree Agree 


Digital Intelligence (DI) solutions make digital data accessible and accelerate time-to-evidence. The 
optimal DI solution allows agencies to collect, review, analyze, and manage large volumes of digital 
evidence in a way that modernizes and centralizes the entire investigative workflow while securely sharing 
data when needed. 


Accelerated transformation, however, can only be achieved when agencies upskill their personnel 

to expertly handle digital evidence and find crucial evidence in any scenario, ultimately resolving or 
building a stronger case. A secure process around storing and sharing digital evidence is also vital for 
any organization. This includes the way an organization implements technology while handling unique 
organizational needs and context. 
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Half of agency managers believe their staff is insufficiently 
trained for the age of digital investigation 

The report suggests that agencies need to prioritize training. The majority of investigators agree that 
reviewing digital data is too complex. And half of agency management respondents believe their employees 


are not sufficiently trained to handle the challenges in the digital investigation age. A comprehensive 
training program is a must for organizations. 


The employees at my agency are not sufficiently trained to handle 
the growing challenges in the digital investigation age. 


RR RR LR 


Q IQ IQ IQ 


Q IQ IQ IQ 


Q IQ IQ IQ 


Q IQ IQ IQ 


49% 


2021 Digital Intelligence Benchmark Report 


Cellebrite s 
Digital Intelligence Platform 


Solving The Investigative 
Workflow 


The ideal end-to-end Digital Intelligence 
capability should bring the entire investigative 

and intelligence process together into a single, 
smooth workflow. It should also expedite the 
collection and review of evidence digitally from any 
device or source, whether it’s physical objects or 
digital information—so it's preserved and securely 
available to those who need it—anywhere, 
anytime. 


Teams need to be able to analyze evidence quickly, 
to find the “golden evidence” that resolves cases 
faster. 


Agencies need to be empowered to manage all 
data digitally, making evidence instantly available 
across teams to facilitate easy collaboration while 
keeping data private, clean, and court-ready. 
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Key Takeaways 


Based on the responses from this year’s Digital 
Intelligence Benchmark Report, the path forward 

is clear: Digital Intelligence will continue to grow 
in its importance to solving cases faster and 
protecting communities. To meet the demands of 
the future, agencies need the right strategy, tools, 
and training to begin transforming today. Here are 
some important next steps to consider: 


1. Assess the Gap: 

For agencies just beginning their digital journey, 
the first step to transformation requires serious 
self-evaluation. Where is your team today in terms 
of its skill level and understanding of the digital 
investigation process? What infrastructure do you 
already have in place that can be leveraged and 
built upon? What best practices are your team 
members utilizing to conduct smarter, more 
efficient investigations? Most importantly, where 
do you want your agency to be in five to 10 years? 
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2. Establish a DI Strategy: 

Building the ultimate investigative workflow for 
the digital age—from operations, to infrastructure, 
to human capital, to the day-to-day processes 
themselves—requires skill, knowledge, and 
foresight. With a solid DI strategy, the entire 
agency can be fully prepared for whatever the next 
investigation throws their way, bringing the vision 
of digital policing within reach. 


3. Tool Up for Success: 

Cases are becoming more complicated and time- 
consuming to solve as the number of devices 

and data associated with each case grows. 
Consider how the right tools and training can help 
streamline your workflow to expedite time-to- 
evidence and run your operation more efficiently. 
Investment must be made in the solutions needed 
to efficiently collect, review, analyze, manage, and 
obtain insights from data lawfully obtained from 
any device or source to solve crimes faster. 


Conclusion 


4. Train for Tomorrow: 

Criminals and crime syndicates are becoming 
increasingly more digitally savvy. To stay a step 
ahead, investing in Digital Intelligence training for 
personnel at all levels is paramount. 


5. Create a Culture of Collaboration: 
Damaging information silos that exist within 
agencies and between them must be broken down 
by building a first-class investigative workflow 

- operations, infrastructure, personnel, and 
processes - that is fit for the Digital Age. 


Public safety isn't just about stopping criminals. It's about understanding the dangers our communities 


face from every angle so you can confidently take bad actors off your streets. With Digital Intelligence you, 


and your peers can take public safety to the next level by gaining the knowledge, expertise, and solutions 


built for the world our community lives in - the digital world. At Cellebrite, we have the expertise and 


technology to help you begin transforming your agency to embrace digital policing to protect and save lives, 


accelerate justice, and preserve data integrity in the new Digital Investigation Age. 
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